Set Up Cross-Account CodePipeline with IAM Roles and Manual Approvals for AWS DevOps Engineer Professional
A company uses multiple AWS accounts: one for development, one for testing, and one for production. They want to implement a CI/CD pipeline using AWS CodePipeline that deploys the same application to all three accounts. The source code is stored in a CodeCommit repository in the development account. The pipeline should first build the application, then deploy to development, then after approval, deploy to testing, and finally after another approval, deploy to production. The deployment uses AWS CodeDeploy to deploy to EC2 instances in each account. The pipeline will be created in the development account. Which configuration will allow the pipeline to deploy to the testing and production accounts?
Quick Answer
The correct answer is to create IAM roles in the testing and production accounts that grant CodeDeploy permissions, and configure the pipeline to assume those roles using the CodePipeline cross-account action. This works because CodePipeline uses role-based access rather than user credentials; by specifying a trust policy that allows the pipeline’s execution role in the development account to assume a deployment role in each target account, you enable secure, temporary cross-account access for CodeDeploy actions. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this scenario tests your understanding of the cross-account action type in CodePipeline, which requires the role ARN from the target account—a common trap is confusing this with IAM users (which cannot be used programmatically by pipelines) or assuming AWS Organizations automatically grants cross-account permissions. Remember the memory tip: “Roles, not users, for cross-account pipelines—trust the ARN, not the account.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create IAM roles in the testing and production accounts that grant CodeDeploy permissions, and configure the pipeline to assume those roles using the CodePipeline cross-account action.
The pipeline can assume IAM roles in the testing and production accounts to perform cross-account deployments. CodePipeline's cross-account action requires you to specify the ARN of an IAM role in the target account that has the necessary permissions for CodeDeploy. This is the secure and recommended method for cross-account access. Option B is incorrect because VPC peering does not provide cross-account IAM permissions; it only allows network connectivity. Option C is incorrect because using IAM users with programmatic access is not a best practice for service-to-service authentication; roles are more secure and manageable. Option D is incorrect because AWS Organizations does not automatically grant cross-account access; you still need to configure IAM roles and trust policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create IAM roles in the testing and production accounts that grant CodeDeploy permissions, and configure the pipeline to assume those roles using the CodePipeline cross-account action.
Why this is correct
Cross-account roles are the standard way to allow a pipeline in one account to deploy to another.
- ✗
Establish VPC peering between the accounts and allow the pipeline to communicate directly with CodeDeploy in the other accounts.
Why it's wrong here
VPC peering does not provide cross-account access to CodeDeploy.
- ✗
Create IAM users in testing and production accounts with programmatic access, and configure the pipeline to use those credentials.
Why it's wrong here
IAM users are not recommended for cross-account automation; roles are preferred.
- ✗
Use AWS Organizations to create a shared service and grant the pipeline full access to all accounts.
Why it's wrong here
Organizations does not automatically grant cross-account access; roles are still needed.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a multi-account AWS environment with separate accounts for development, staging, and production. They want to implement a CI/CD pipeline that deploys to each account sequentially after manual approvals. Which setup allows cross-account deployment with CodePipeline?
hard- ✓ A.Create an IAM role in the target account with permissions for the pipeline service role to assume, and use that role in the deployment action.
- B.Create separate pipelines in each account and trigger them via SNS from a master pipeline.
- C.Use CodePipeline with cross-account actions by specifying the target account ID and region.
- D.Use a single pipeline in the management account with different stages for each account.
Why A: CodePipeline supports cross-account deployments by having the pipeline service role in the source account assume an IAM role in the target account. This role must have a trust policy allowing the pipeline service role to assume it, and the deployment action (e.g., CloudFormation, CodeDeploy) references that target account role. This enables sequential deployment to development, staging, and production accounts with manual approval gates between stages.
Variation 2. Which THREE steps are required to set up a cross-account CodePipeline that deploys to an EC2 instance in a target account? (Choose three.)
hard- ✓ A.Create an IAM role in the target account with permissions to deploy to EC2.
- ✓ B.Add a trust policy to the target account role allowing the pipeline account to assume it.
- ✓ C.Grant the pipeline service role permission to assume the target account role.
- D.Configure the pipeline to use the target account's default KMS key for artifacts.
- E.Create a CodePipeline in the target account.
Why A: The target account must have an IAM role that grants permissions to deploy to EC2 (e.g., ec2:RunInstances, ssm:SendCommand). This role is assumed by the pipeline in the source account to perform deployments in the target account, following the cross-account access pattern using IAM roles.
Variation 3. Which TWO steps are required to set up a cross-account CI/CD pipeline where the source stage is in Account A (CodeCommit) and the deploy stage is in Account B (ECS)? (Choose 2.)
medium- ✓ A.Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action.
- B.Configure an AWS KMS key in Account B and share it with Account A for encrypting artifacts.
- ✓ C.Update the CodePipeline service role in Account A to include a trust policy that allows assuming the role in Account B.
- D.Create a resource-based policy on the CodeCommit repository in Account B that grants access to the CodePipeline service role in Account A.
- E.Create an S3 bucket in Account B to store the artifacts and grant cross-account access.
Why A: For a cross-account CI/CD pipeline where the source stage (CodeCommit) is in Account A and the deploy stage (ECS) is in Account B, only two steps are required: 1) Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action (Option A). 2) Update the CodePipeline service role in Account A to include a trust policy that allows assuming the role in Account B (Option C). You do not need a KMS key in Account B; if the artifact bucket in Account A is encrypted with a customer-managed AWS KMS key, the key is in Account A and its policy must grant Account B's role kms:Decrypt, but that is not one of the required setup steps in the options. Option D is incorrect because the CodeCommit repository is in Account A, not Account B. Option E is incorrect because the pipeline artifact bucket should reside in Account A, not Account B.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.